diff --git a/freeipa.spec b/freeipa.spec
index 2d12304..9aef0a4 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -81,7 +81,7 @@
 # Fedora
 %global package_name freeipa
 %global alt_name ipa
-%global krb5_version 1.16.1
+%global krb5_version 1.17
 %global krb5_kdb_version 7.0
 # 0.7.16: https://github.com/drkjam/netaddr/issues/71
 %global python_netaddr_version 0.7.16
@@ -110,7 +110,8 @@
 
 # One-Way Trust authenticated by trust secret
 # https://bugzilla.redhat.com/show_bug.cgi?id=1345975#c20
-%global sssd_version 1.16.3-2
+# Also, PYSSS: Re-add the pysss.getgrouplist() interface
+%global sssd_version 2.0.0-4
 
 %define krb5_base_version %(LC_ALL=C rpm -q --qf '%%{VERSION}' krb5-devel | grep -Eo '^[^.]+\.[^.]+')
 
@@ -1732,6 +1733,10 @@ fi
 
 
 %changelog
+* Sun Nov 11 2018 Alexander Bokovoy <abokovoy@redhat.com> - 4.7.1-2
+- Rebuild for krb5-1.17 (#1648673)
+- Bump required SSSD version to 2.0.0-4 to get back pysss.getgrouplist() API
+
 * Fri Oct  5 2018 Rob Crittenden <rcritten@redhat.com> - 4.7.1-1
 - Update to upstream 4.7.1